Re: [TLS] RFC-4366-bis and the unrecognized_name(112) alert

[Peter Sylvester <[e-mail]>]

>
> In my TLS code, there is a simple configuration scheme that applications
> use to tell the TLS layer which domain names map to which certificate
> chains.  Once set up, the application doesn't need to do anything more
> since the TLS code then handles certificate selection based on the SNI,
> version, cipher suite, supported signature algorithms, and key usage.
> It's quite complicated.
One might call this a facility intermediate layer to simplify application
coding for "common" cases.
>
> You might condemn this as some sort of layering violation, but it really
> does make life easier for application writers.  I wrote the code once
> instead of requiring every application writer to have to reinvent it.
Internal API structures and features do not necessarily need to follow
protocol layers and provide for all options. No problem I think.

Whether it is better to have apis aligned with protocol layers depends
on the protocols, the layer structure, application needs, the temperature
of coffee etc.   Shadokism and/or oversimplification may occur.